CRACI vs StepSecurity | Harden-Runner and Build Egress

The short answer

StepSecurity is a software supply chain security platform that covers four control points: developer machines, package registries, code repositories and CI/CD. Its CI/CD product, Harden-Runner, is an agent that watches every outbound connection, process and file write in a job, ties each one to the workflow step that caused it, and can block egress to anything not on an allowlist. CRACI replaces the runner itself: its egress policy is enforced by the runner platform and validated before the job starts, and the same job produces an SBOM and signed provenance.

This is the closest overlap CRACI has with any security vendor, because both restrict what a build can reach. The difference is where the control lives. Harden-Runner secures runners you keep, including GitHub-hosted ones. CRACI's policy comes with being the runner, and it records packages rather than only destinations. StepSecurity's registry, repository and developer machine products do not depend on the runner, so they can sit alongside CRACI.

At a glance

Capability	CRACI	StepSecurity
Where it runs	It is the runner. Jobs run on CRACI.	An agent on runners you already use, added as a job step or baked into the runner image.
Block build egress	Default deny or allow, validated before the job	Domain allowlist in block mode
Audit mode and baselines	Monitor or dry-run mode	Per-job baselines with anomaly detection
Process and file-write monitoring		Correlated to each workflow step
Package-level SBOM of each build	Per job, with a completeness state	Records destinations, processes and files
CRA evidence and reports	PDF, HTML, CSV, Excel, JSON
GitHub-hosted runners	CRACI replaces these runners	Linux full; Windows and macOS audit only
Self-hosted runners and other CI	GitHub Actions on CRACI runners only	ARC, VMs, GitLab CI, Azure DevOps
Package blocklists and cooldowns	Org-wide package blocklists	Secure Registry, for laptops and CI
Developer machines		Dev Machine Guard
Price	Pro €30 per month until end of 2026, including 10,000 build minutes of compute.	Free for public repositories on GitHub-hosted runners. Enterprise $16 per contributing developer per month; runner costs separate.

Included
Not included
On the roadmap

What StepSecurity does well

Harden-Runner

Step-level visibility. Each outbound connection, file operation and process execution is mapped to the exact step, job and workflow where it happened. The Enterprise tier adds process arguments, file write paths, and alerts by email, Slack, Microsoft Teams or your SIEM.
Audit first, then block. In egress-policy: audit mode Harden-Runner builds a baseline of each job's normal outbound calls and flags anything new. You can then switch to block mode with an allowlist of endpoints. A global block list of known-malicious domains, maintained by StepSecurity, applies even in audit mode.
Tamper detection. It alerts on unexpected changes to source code during the build.
Broad coverage. Full support on GitHub-hosted Linux runners, audit mode on GitHub-hosted Windows and macOS, and, on the Enterprise tier, self-hosted VMs, bare metal and Actions Runner Controller, plus GitLab CI and Azure DevOps pipelines. On self-hosted runners the agent is built into the runner image, so workflows need no changes.
Track record. StepSecurity reports that Harden-Runner detected the tj-actions/changed-files compromise (CVE-2025-30066) and the compromised axios npm package. The community-tier Linux agent is open source.

The rest of the platform

Secure Registry: cooldown periods for new package versions, blocking of known-compromised versions, typosquat protection and org-wide blocklists, with one policy for laptops and CI.
Code Repo Security: pull request checks, and Orchestrate Security, which opens pull requests that pin actions to commit SHAs, set least-privilege GITHUB_TOKEN permissions and roll out Dependabot configurations.
Dev Machine Guard: an inventory of AI coding agents, MCP servers, IDE extensions and packages on developer machines.

Where CRACI is different

Being the runner, not an agent on it

On GitHub-hosted runners, Harden-Runner is installed by a step you add as the first step of each job. StepSecurity documents that it is not supported when a whole job runs in a container on GitHub-hosted runners, or on ubuntu-slim. None of that is a flaw in the product; it follows from running on infrastructure GitHub owns.

CRACI's policy is part of the runner. It is validated before the job starts, rejects unknown fields, and fails closed, so a policy that cannot be applied does not produce an unprotected run.

Packages, not only destinations

Harden-Runner's allowlist is a list of endpoints, and its network insights show which hosts each step contacted. CRACI's sources are typed by ecosystem, with 24 built-in software-source presets, custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git over HTTPS and SSH, and explicit TLS, TCP, UDP and ICMP rules. A package-aware proxy records which packages each job fetched, including packages restored from CI caches, and produces a CycloneDX or SPDX SBOM with a completeness state per job and per cache.

After the build

Signed provenance links each artifact, including OCI artifacts, to its build, using Ed25519 over SHA-512. No SLSA level is claimed.
Monitoring re-evaluates the SBOMs of what you shipped as new vulnerabilities appear.

Where StepSecurity is ahead

To be plain about it: CRACI has no audit or monitor mode yet (it is on the roadmap), does not monitor processes or file writes, does not run on GitHub-hosted runners or other CI systems, has package blocklists only on its roadmap, and does not cover developer machines. If those are your priorities, StepSecurity covers them today.

Price

As of September 2026, StepSecurity's Community tier is free for unlimited public repositories on GitHub-hosted runners. The Enterprise tier costs $16 per month per contributing developer, meaning anyone who contributed to a secured repository in the last 90 days, and includes Dev Machine Guard and Secure Registry. Private repositories and self-hosted runners need Enterprise, and there is a 14-day free trial. Harden-Runner secures runners you already pay for, so runner minutes are a separate cost.

CRACI's Pro plan is €30 per month until end of 2026 and includes 10,000 build minutes of compute, with more at €0.002 per vCPU-minute. See CRACI pricing for current terms.

Which one fits

StepSecurity is the better fit when

You want to keep GitHub-hosted runners, including Windows and macOS.
You run self-hosted runners, GitLab CI or Azure DevOps.
You want to watch traffic in audit mode before you block anything.
You need process and file-level visibility for incident response.
Your open-source project runs on GitHub-hosted runners and needs a free option.

CRACI is the better fit when

You want the runner and the egress policy in one place, with no agent to deploy.
You need a package-level SBOM from each build, with a completeness state.
You want signed provenance and monitoring of what shipped.
You need CRA evidence, or EU data residency on CRACI's Enterprise plan.

Using both

Secure Registry, Code Repo Security and Dev Machine Guard protect points CRACI does not touch: the registry your packages come from, your repositories, and developer laptops.

For the Cyber Resilience Act

The Cyber Resilience Act asks manufacturers to know the components in their products, handle vulnerabilities in them, and keep evidence. StepSecurity focuses on preventing and detecting supply chain attacks, and its runtime insights help when you investigate an incident in CI. CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process: build-time SBOMs, vulnerability tracking, provenance, and reports in PDF, HTML, CSV, Excel and JSON.

Moving jobs to CRACI

Install the CRACI GitHub App on your organization, then change the runner label on a job to runs-on: craci. If you already use Harden-Runner in block mode, its allowed-endpoints list tells you which sources a job needs, which is a good starting point for a CRACI policy. Read more about CI/CD integration and build-time SBOM generation.